Of all the GDPR rights, restriction of processing is the least known. Yet it solves a very practical problem: what happens to your data while a dispute is open? Without this tool, a company could keep using data you believe is wrong while it "checks" it, or delete information you need to keep. Article 18 of Regulation (EU) 2016/679 lets you put the data in a kind of suspended state.
What "restricting" means
Restricting processing means the controller may continue to store the data but may not use it except in narrow cases. It is like putting a file in a locked drawer: it exists, but nobody consults it to make decisions or to send you communications.
During the restriction the controller may process the data, apart from storing it, only:
- with your consent;
- for the establishment, exercise or defence of legal claims;
- for the protection of the rights of another natural or legal person;
- for reasons of important public interest of the Union or of a Member State.
The four cases in which you can request it
Article 18 sets out specific situations.
1. You contest the accuracy of the data
You have asked for rectification and the controller has to check. For as long as the check lasts, you can ask that the disputed data not be used.
Example: a finance company records a late payment you never made. While it investigates, it should not use that information to assess a new application from you.
2. The processing is unlawful but you do not want erasure
Sometimes erasure is not the best solution. If a company collected your data without a legal basis, you might prefer it to keep the data, without using it, because you need it as evidence.
3. The controller no longer needs the data, but you do
The controller is about to delete the data because its purposes are exhausted, but you need it to establish or defend a legal claim.
Example: a security company keeps camera footage for a short time and then overwrites it. If that footage shows evidence of damage you suffered, you can ask for it not to be deleted.
4. You have objected and a decision is pending
You have exercised the right to object under Article 21 and the controller must assess whether its legitimate grounds override yours. Pending that assessment, the data stays restricted.
How it is applied in practice
Recital 67 of the GDPR mentions some technical methods: temporarily moving the data to another system, making it unavailable to users, temporarily removing it from a website. In IT systems the restriction should be clearly flagged, so that anyone opening the record knows that the data may not be used.
When the restriction is lifted, for example because the accuracy check has ended, the controller must inform you before lifting it. It therefore cannot resume using the data without telling you.
How to make the request
| Element | What to write |
|---|---|
| Legal reference | "I request restriction of processing under Article 18 GDPR" |
| Data concerned | Which data you want frozen, with precise references |
| Reason | Which of the four cases applies |
| Link | Any request for rectification or objection already sent |
| Final request | Written confirmation that the restriction is in place |
Restriction is often requested in the same letter used to exercise another right: "I request rectification of item X and, pending verification, restriction of processing".
The response times are the general ones under Article 12: one month, extendable by two months in complex cases with a reasoned notice. Given the nature of the request, however, a diligent controller should apply the freeze immediately, especially where there is a risk of the data being deleted.
The duty to notify recipients
As with rectification and erasure, the controller must communicate the restriction to every recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort, under Article 19. If you ask, the controller must tell you who those recipients are.
When it is not the right tool
Restriction is a temporary, protective measure. If you want the data gone, the right to exercise is erasure; if you simply want no more advertising, objecting to marketing is more direct. Using restriction instead of these rights risks leaving the situation unresolved for longer than necessary.
In short
- Article 18 GDPR lets you freeze data: the controller keeps it but does not use it.
- You request it when you contest accuracy, when processing is unlawful but you want the data kept, when you need it for legal claims or while an objection is pending.
- The controller must inform you before lifting the restriction.
- The restriction must be communicated to the data's recipients, as Article 19 requires.
- It is best requested together with rectification or objection, in the same message.